Executive brief
Netmaker is a network management and orchestration platform. The DNS deletion API endpoint contains a SQL injection vulnerability that allows authenticated users to extract sensitive data from the SQLite database by crafting specially-formed DNS record names and observing whether the deletion succeeds or fails. This could allow an attacker to discover database structure, usernames, credentials, and other confidential information stored in the database.
Technical details
The vulnerability exists in Netmaker's `sqliteDeleteRecord` function, which constructs SQL DELETE statements using string concatenation: `deleteSQL := "DELETE FROM " + tableName + " WHERE key = \"" + key + "\""`. The `key` value originates from the {domain} path parameter of the DELETE /api/dns/{network}/{domain} endpoint and is embedded directly without parameterization. While PostgreSQL deployments are unaffected due to use of parameterized queries, SQLite backends are vulnerable. An authenticated attacker can inject SQL operators (e.g., `" OR 1=1 --`) into the domain parameter to manipulate query logic. By observing whether the DNS record is deleted (condition true) or retained (condition false), the attacker can perform time-efficient data exfiltration to discover table names, column names, values, and their lengths. The vulnerability requires authentication but no user interaction beyond crafting API requests. Patches are available in version 1.5.0 and later, which replace string concatenation with parameterized SQL queries.
Affected products
- Gravitl Netmaker < 1.5.0
Timeline
- 2026-09-15: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-09-15: patched: Fixed in version 1.5.0 released February 18, 2027